--- title: "Pricing | Phase secrets manager" description: "Simple pricing for effortless security. Explore features, whether you are self-hosting or using Phase Cloud." url: https://phase.dev/pricing/ --- Pricing # Simple pricing for effortless security. TL;DR โ€” only pay for human users, with a flat pricing option for unlimited users. PlansCloud / Self-hosted ## Phase Cloud plans ### Free $0 Try Phase without any commitments. Great for personal and hobby projects. [Get started](https://console.phase.dev) - All core platform features - Up to 5 Users or Service Accounts - Up to 3 Apps - 3 Environments - dev, staging, prod - Google/GitHub/GitLab OAuth SSO - AI Agent Integration - Phase Agents Relay ### Pro $10/ month / user $144 a year billed monthly, $120 billed annually 14 days free trial For teams and AI agents to deploy and secure secrets across all environments. [Start free](https://console.phase.dev) - Everything in Free - Unlimited Users & Service Accounts - Unlimited Apps - 10 Custom Environments - Teams - Custom Roles (RBAC) - Network Access Policies - Point-in-time Recovery - Automated Secret Rotation - 90-day Audit Logs ### Enterprise $25/ month / user $360 a year billed monthly, $300 billed annually 14 days free trial For organizations in need of advanced access control and visibility of secrets across teams. [Start free](https://console.phase.dev) - Everything in Pro - Unlimited Custom Environments - OIDC SSO - SCIM Provisioning - Dynamic Secrets - Global Network Access Policies - Third-party KMS - Audit Log Forwarding - SIEM Integration - SOC 2 Type 2 Audit Report - External Penetration Testing Reports ## Self-hosted plans ### Free $0 Self-host Phase for free. Great for personal projects and small teams. [Deploy now](https://docs.phase.dev/self-hosting) - All core platform features - Unlimited Users & Service Accounts - Unlimited Apps - 3 Environments - dev, staging, prod - Google/GitHub/GitLab/Authentik OAuth SSO - AI Agent Integration - Phase Agents Relay - Zero Usage Analytics or Outbound Telemetry ### Pro $10/ month / user $120 billed annually Free trial For teams needing advanced features on self-hosted infrastructure. - Everything in Free - Unlimited Users & Service Accounts - Unlimited Apps - 10 Custom Environments - Teams - Custom Roles (RBAC) - Network Access Policies - Point-in-time Recovery - Automated Secret Rotation ### Enterprise Custom pricing Flat pricing ยท Unlimited seats Free trial Run on your own infrastructure. Maintain complete control. Keep secrets behind firewalled lines. - Everything in Pro - Unlimited Custom Environments - OIDC SSO - SCIM Provisioning - Dynamic Secrets - Global Network Access Policies - Third-party KMS - Audit Log Forwarding - SIEM Integration - SOC 2 Type 2 Audit Report - External Penetration Testing Reports CompareAll features Features Free Pro Enterprise Limits Users Organization members 5 Unlimited Unlimited Apps Number of applications 3 Unlimited Unlimited App Readme Private documentation for critical application and project related instructions Included Included Included Environments Development, CI, QA, Staging, Production, etc. 3 10 Unlimited Core features Automatic Secret Versioning Track changes to secrets over time by various users in Git-style diffs Included Included Included One-click Secret Recovery Restore previous secret versions instantly Included Included Included One-click Secret Access Securely generate a temporary token + bash one-liner command to quickly access secrets on any machine Included Included Included Secret Referencing Create secrets that point to the value of other secrets across different paths, environments and apps Included Included Included Global Secret Search Securely search secrets across all Apps, Environments, and Folders in your organization from the command palette Included Included Included Lockbox Secret Sharing Securely share secrets with those outside your organization via a link Included Included Included Personal Secrets & Overrides Override the value of a secret that is unique to you, without affecting others on your team Included Included Included Secret Generation Securely generate secret values Included Included Included Secret Folders Organize secrets into folders and paths Included Included Included Secret Tags Organize and filter secrets using custom tags Included Included Included Phase Shell Securely create a virtual shell environment with secrets exposed as environment variables Included Included Included CLI Monorepo Support Maintain project context across nested directories in a monorepo with a single root config Included Included Included CLI & SDK Offline Mode Access an encrypted local cache fallback for secrets & configs via the CLI and SDKs when the network is unavailable Included Included Included REST API Programmatically create, read, update, delete secrets using any HTTP client Included Included Included Integrations Docker & Docker Compose Integration Inject secrets into Docker containers Included Included Included Secret Sync Integrations Automate secret deployment to GitHub Actions, AWS Secrets Manager, Cloudflare, Vercel, Railway etc. Included Included Included Kubernetes Operator Securely sync secrets to Kubernetes cluster. Automate pod redeployments after secret or configmap changes Included Included Included Terraform Provider Securely access secrets in your IaC. Manage resources in Phase via Terraform Included Included Included SDKs Securely manage secrets from your application. Support for Python, Node, Golang, more coming soon Included Included Included AI Agent Integration Native skill-based integration for โ€” Claude Code, Cursor, VS Code Copilot, Codex, OpenCode etc. Included Included Included Phase Agents Relay AI egress credential proxy / connection broker Included Included Included Webhooks Notify external systems on changes to secrets. Integrate with Slack, Discord, PagerDuty, etc. Not included Included Included SIEM Integration Send secret audit logs to your SIEM. Integrate with Splunk, Elastic, Datadog, etc. Not included Not included Included Security & access control External Identity Provider Programmatically authenticate Users and Service Accounts via external third party identity providers Included Included Included Teams Group members into teams for cleaner permission management and scoped access Not included Included Included Access Control (RBAC) Define roles, policies and enforce permissions Basic Custom Roles Custom Roles OAuth 2.0 SSO OAuth 2.0 Single-sign-on authentication identity provider Included Included Included OpenID Connect (OIDC) SSO OpenID Connect (OIDC) Single-sign-on authentication identity provider Not included Not included Included SCIM Provisioning System for Cross-domain Identity Management (SCIM) automated user provisioning and deprovisioning Not included Not included Included Network Access Policies Manage access control to resources by filtering access based on client IPv4/v6 ranges and CIDR blocks Not included Included Included Global Network Policies Enforce network access policies across all resources in your organization Not included Not included Included Third-party KMS Use your own encryption keys from AWS KMS, Azure Key Vault or Google Cloud KMS Not included Not included Included Operations & reliability Point-in-time Recovery Restore an environment state to a given point in time Not included Included Included Secret Rotation Automatically rotate database credentials, API keys etc. Not included Included Included Dynamic Secrets Generate short-lived on-demand unique secrets for each retrieval with automated lease management Not included Not included Included Audit Log Retention How long audit logs are kept 24 hours 90 days Custom Audit Log Forwarding Ship secret audit logs to an external data store or a log management platform Not included Not included Included Rate Limits API request per minute limits across an organization 120/minute 240/minute Custom Uptime SLA Service availability and uptime guarantees 99.99% Compliance SOC 2 Type 2 Audit Report Latest report & findings from independent third-party SOC 2 Type 2 audit Included External Penetration Testing Reports Latest report & findings from independent third-party external penetration testing Included Support Community Support Over GitHub Discussions & #phase-help Slack channel Included Included Included Email Support Priority support via email Not included Included Included Slack Support Dedicated private Slack channel Not included Not included Included Dedicated Live Support & SLAs Prioritized support & response times Not included Not included Optional Addon Standalone Dedicated Instance Single tenant instance on infrastructure of your choice, managed by us Not included Not included Optional Addon Trusted by thousands of teams ![Zeiss](https://phase.dev/assets/images/customers/zeiss.svg) ![Alchemy](https://phase.dev/assets/images/customers/alchemy.svg) ![GSA](https://phase.dev/assets/images/customers/gsa.svg) ![AoPS](https://phase.dev/assets/images/customers/aops.svg) ![StoryLLP](https://phase.dev/assets/images/customers/storyllp.svg) ![Magneto](https://phase.dev/assets/images/customers/magneto.svg) ![NaroIQ](https://phase.dev/assets/images/customers/naroiq.svg) ![Sellhub](https://phase.dev/assets/images/customers/sellhub.png) ![theFactor.e](https://phase.dev/assets/images/customers/thefactore.svg) ![Palo Alto Networks](https://phase.dev/assets/images/customers/palo-alto-networks.png) RoadmapCommunity-driven Request a feature We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us. [Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md) FAQQuestions ## Frequently asked questions Phase supports two types of accounts: User accounts are for human users while Service accounts are for programmatic access. Both account types can have roles (Owner, Admin, Developer, Custom), policies (Create, Read, Update, Delete) and access to application secrets and environments (Development, Staging, Production). We only charge for User accounts (human users). Service accounts are free and unlimited. You only need to pay for human users who need access to the Phase Console or CLI. Service accounts used for machine access are free. For example: You might have 1 User account for a senior developer, and multiple Service accounts for all programmatic access in your CI/CD pipelines and Kubernetes clusters โ€” you would only pay for the 1 User account. Yes, we have a graduated pricing discount model. Please reach out to us at [info@phase.dev](mailto:info@phase.dev) with your specific requirements for number of users and we'll be happy to work out a solution. Yes, if you're unsure about your user requirements, we offer flat pricing options that might better suit your needs. Please reach out to us at [info@phase.dev](mailto:info@phase.dev) with your specific requirements. Yes, we offer a 14-day free trial period as a standard across Phase Cloud and self-hosted instances. For Enterprise customers, we can provide a more flexible trial period to ensure you can properly integrate and evaluate the product for your requirements. Phase Cloud is hosted in the EU ๐Ÿ‡ช๐Ÿ‡บ on Amazon Web Services (AWS) in the eu-central-1 (Frankfurt ๐Ÿ‡ฉ๐Ÿ‡ช) region. Phase operates on an end-to-end encrypted model by default. Certain features may require Server-side encryption, which can be enabled based on your requirements. For comprehensive information about our security measures, please visit our [security documentation](https://docs.phase.dev/security). Phase Cloud is our fully-managed service that provides enterprise-grade infrastructure with global co-location, smart routing, and edge caching for optimal performance. It includes built-in security features like DDOS protection, WAF (Web Application Firewall), automated backups, auto-scaling and disaster recovery. You always have access to the latest version of Phase through instant updates. While self-hosting gives you complete control over your infrastructure and data, Phase Cloud removes the operational overhead of managing these components yourself. Yes, we can build custom features for special use cases for a one-time development fee. You may reach out to us via [email](mailto:info@phase.dev) or [Slack](https://slack.phase.dev). If you need our solution for your security requirements but don't have the funds for it, we're here to help. Whether you're a student in school or college working on a project, or a non-profit organization, please reach out to us and we'll be happy to work out a solution. Contact us by [email](mailto:info@phase.dev) or [Slack](https://slack.phase.dev) for more details. DeploymentSelf-hosted / Cloud Get started ## Keep your secrets Self-host or start on fully managed Cloud in under a minute. Self-hosted Run Phase on your own infrastructure. Free and open source. AI agent deployment skill [![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi) [Self-hosting guide](https://docs.phase.dev/self-hosting) Cloud Fully managed. From signup to your first secret in 60 seconds. Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)